High, CVSS 7.5
libp2p DoS vulnerability from lack of resource management
Go github.com/libp2p/go-libp2p · Upgrade to 0.18.0 or later · < 0.18.0 · CVE-2022-23492 · GHSA-j7qp-mfxf-8xjw
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
libp2p DoS vulnerability from lack of resource management
crates.io libp2p · Upgrade to 0.45.1 or later · <= 0.45.0 · CVE-2022-23486 · GHSA-jvgw-gccv-q5p8
- Critical, CVSS 9.3
PaddlePaddle vulnerable to Code Injection
PyPI paddlepaddle · Upgrade to 2.4.0 or later · < 2.4.0 · CVE-2022-46742 · GHSA-gcjf-29m9-888q · amended
- Critical, CVSS 9.1
PaddlePaddle Out-of-bounds Read vulnerability
PyPI paddlepaddle · Upgrade to 2.4 or later · < 2.4 · CVE-2022-46741 · GHSA-2hvc-hwg3-hpvw · amended
- High, CVSS 8.1
Casdoor arbitrary file deletion vulnerability via uploadFile function
Go github.com/casdoor/casdoor · Upgrade to 1.126.1 or later · < 1.126.1 · CVE-2022-44942 · GHSA-f93f-55c2-8c89
- High, CVSS 7.5
Quarkus CORS filter allows simple GET and POST requests with an invalid Origin to proceed
Maven io.quarkus:quarkus-vertx-http · Upgrade to 2.14.2.Final or 2.13.5.Final by release line · >= 2.14.0.CR1, < 2.14.2.Final; < 2.13.5.Final · CVE-2022-4147 · GHSA-9895-g6x5-xwcp
- Critical, CVSS 9.3
py7zr directory traversal vulnerability
PyPI py7zr · Upgrade to 0.20.1 or later · <= 0.20.0 · CVE-2022-44900 · GHSA-m8xw-9x5x-6vh3 · amended
- High, CVSS 8.2
Passeo uses insecure random number generator
PyPI passeo · Upgrade to 1.0.5 or later · < 1.0.5 · CVE-2022-23472 · GHSA-mhhf-vgwh-fw9h · amended
- Critical, CVSS 9.2
GitPython vulnerable to Remote Code Execution due to improper user input validation
PyPI gitpython · Upgrade to 3.1.30 or later · <= 3.1.29 · CVE-2022-24439 · GHSA-hcpj-qp55-gfph · amended
- High, CVSS 8.1
simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol
npm simple-git · Upgrade to 3.15.0 or later · < 3.15.0 · CVE-2022-25912 · GHSA-9p95-fxvg-qgq2 · amended
- High, CVSS 8.8
Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace
Go github.com/clastix/capsule · Upgrade to 0.1.3 or later · <= 0.1.2 · CVE-2022-46167 · GHSA-x45c-cvp8-q4fm
- Critical, CVSS 9.4
NodeBB vulnerable to account takeover via prototype vulnerability
npm nodebb · Upgrade to 2.6.1 or later · < 2.6.1 · CVE-2022-46164 · GHSA-rf3g-v8p5-p675 · amended
- High, CVSS 7.2
Prometheus vulnerable to basic authentication bypass
Go github.com/prometheus/prometheus +1 · Upgrade all 2 to 2.40.4 or 2.37.4 by release line · >= 2.24.1, < 2.37.4; >= 2.38.0, < 2.40.4 · GHSA-4v48-4q5m-8vx4
- High, CVSS 7.5
Craft CMS discloses password hashes
Packagist craftcms/cms · Upgrade to 3.7.33 or later · >= 3.0.0, <= 3.7.32 · CVE-2022-37783 · GHSA-h972-v458-m892
- Critical, CVSS 9.8
camel-ldap component allows LDAP Injection when using the filter option
Maven org.apache.camel:camel-ldap · Upgrade to 3.18.4 or 3.14.6 by release line · < 3.14.6; >= 3.15.0, < 3.18.4 · CVE-2022-45046 · GHSA-w66j-xc7r-m2jv
- Critical, CVSS 9.8
Nadesiko3 OS Command Injection vulnerability
npm nadesiko3 · Upgrade to 3.3.69 or later · <= 3.3.68 · CVE-2022-41642 · GHSA-m8r5-7wf4-63mw · amended
- Critical, CVSS 9.8
nadesiko3 vulnerable to OS Command Injection
npm nadesiko3 · Upgrade to 3.3.75 or later · < 3.3.75 · CVE-2022-42496 · GHSA-7249-8x22-4rg4 · amended
- High, CVSS 7.8
TERASOLUNA Server Framework vulnerable to ClassLoader manipulation
Maven org.terasoluna.gfw:terasoluna-gfw-common · Upgrade to 1.0.1.RELEASE or later · < 1.0.1.RELEASE · CVE-2022-43484 · GHSA-q5j9-f95w-f4pr
- High, CVSS 8.4
XBlock vulnerable to Cross-Site Scripting (XSS)
PyPI xblock-drag-and-drop-v2 · Upgrade to 3.0.0 or later · < 3.0.0 · CVE-2022-46147 · GHSA-qv6c-367r-3w6q · amended
- High, CVSS 8.8
ThinkCMF Cross Site Request Forgery (CSRF) vulnerability
Packagist thinkcmf/thinkcmf · Upgrade to 6.0.8 or later · < 6.0.8 · CVE-2022-40489 · GHSA-6xw3-cpqj-8mxr
- Critical, CVSS 9.8
ff4j is vulnerable to Remote Code Execution (RCE)
Maven org.ff4j:ff4j-core · Upgrade to 1.9 or later · >= 1.8.1, < 1.9 · CVE-2022-44262 · GHSA-65hj-9ppw-77xc
- High, CVSS 8.8
Sinatra vulnerable to Reflected File Download attack
RubyGems sinatra · Upgrade to 3.0.4 or 2.2.3 by release line · >= 3.0, < 3.0.4; >= 2.0.0, < 2.2.3 · CVE-2022-45442 · GHSA-2x8x-jmrp-phxw
- Critical, CVSS 9.8
Zenario CMS is vulnerable to Remote Code Execution (RCE).
Packagist tribalsystems/zenario · Upgrade to 9.0.57473 or later · < 9.0.57473 · CVE-2022-44136 · GHSA-4p38-rc98-cr39
- Critical, CVSS 9.1
crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication
Go github.com/crewjam/saml · Upgrade to 0.4.9 or later · < 0.4.9 · CVE-2022-41912 · GHSA-j2jp-wvqg-wc2g
- Critical, CVSS 9.8
owncast is vulnerable to SQL Injection
Go github.com/owncast/owncast · Upgrade to 0.0.13 or later · < 0.0.13 · CVE-2022-3751 · GHSA-cvh4-cjc9-84qm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.